cognito_token_verifier 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b62edbc24a15d7e43934a4ffcb641370e503084caffbac662da565528b3621f4
-  data.tar.gz: 4d562bee7ee8130d082c3f24530a1e62f235c03e176733bdd7b17d7cf7deca09
+  metadata.gz: 02ef1ab0355a54f560d05129aa92616d8545ce11e2535787e9444ca8241e4119
+  data.tar.gz: 34ce55f919bf09784375ad764031eb4f724258e50dc18fcc777a9428ca601d27
 SHA512:
-  metadata.gz: 000d7d04865954163674f2970163cd411fae1a8bbd83cf7f2dd5feeac00f5674367fd07621e135a44c59a2687115092405834ae42a9d5cad5bbbf7353a62a5bf
-  data.tar.gz: e1c17ca0365937f4bad00d395283f9d8f74fc58342cda151a23597c34925d1f058ed2f23ecad157b26a028854225275b4dd5b3b7d4646facf5184a7f280ca972
+  metadata.gz: ea02cd0a5f932fe6e41e4ff23baa33df6219887022a44dd2e0ad4bc4a291b962a0867035e9358f7c9f9556764859ab318a61abf0b5d4147968c2171a0ee1f5e2
+  data.tar.gz: be564bb2c4ef81f015b458e44b033f11d807c7b3cb3b9c960f16c4982dd2090b28e865d0d9c2a9a8a7bd9eaafebeb07f26f84c06f415545846f35ba6f465f4e9

data/CHANGELOG.md

@@ -0,0 +1,9 @@
+# CHANGELOG.md
+
+## 0.2.0 (2019-02-21)
+
+  - Improvements to handling errors fetching JWKs and decoding Cognito JWTs
+
+## 0.1.0 (2019-02-20)
+
+  - Initial release of Cognito token verification gem

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    cognito_token_verifier (0.1.0)
+    cognito_token_verifier (0.2.0)
       activesupport (>= 4.2, < 6.0)
       json-jwt (~> 1.1)
       rest-client (~> 2.0)
@@ -107,7 +107,7 @@ PLATFORMS
 DEPENDENCIES
   actionpack (>= 4.2, < 6.0)
   bundler (~> 2.0)
-  byebug
+  byebug (~> 11.0)
   cognito_token_verifier!
   rake (>= 10.0, < 13.0)
   rspec-rails (~> 3.0)

data/cognito_token_verifier.gemspec

@@ -12,6 +12,7 @@ Gem::Specification.new do |spec|
   spec.summary       = %q{Verify and parse AWS Cognito JWTs to authenticate endpoints}
   spec.homepage      = "https://github.com/CodingAnarchy/cognito_token_verifier"
   spec.license       = "MIT"
+  spec.required_ruby_version = ">= 2.3.8"
 
   # Prevent pushing this gem to RubyGems.org. To allow pushes either set the 'allowed_push_host'
   # to allow pushing to a single host or delete this section to allow pushing to any host.

data/lib/cognito_token_verifier/config.rb

@@ -20,9 +20,12 @@ module CognitoTokenVerifier
     end
 
     def jwks
-      raise ConfigSetupError.new(self) unless aws_region.present? and user_pool_id.present?
-      @jwks ||= JSON.parse(RestClient.get(jwk_url))
-      # TODO: rescue RestClient and JSON errors here to present a more user-friendly error
+      begin
+        raise ConfigSetupError.new(self) unless aws_region.present? and user_pool_id.present?
+        @jwks ||= JSON.parse(RestClient.get(jwk_url))
+      rescue RestClient::Exception, JSON::JSONError => e
+        raise JWKFetchError
+      end
     end
 
     def iss

data/lib/cognito_token_verifier/errors.rb

@@ -12,11 +12,23 @@ module CognitoTokenVerifier
     end
   end
 
+  class JWKFetchError < StandardError
+    def message
+      "Error fetching JWKs for your Cognito user pool.  Please verify your configuration of the CognitoTokenVerifier gem."
+    end
+  end
+
   class TokenMissing < CognitoTokenVerifier::Error
     def message
       "Cognito token not provided.  Please retransmit request with Cognito token in authorization header."
     end
   end
+
+  class TokenDecodingError < CognitoTokenVerifier::Error
+    def message
+      "Cognito token could not be decoded. Please ensure the request token is from the correct Cognito user pool and try again." 
+    end
+  end
   
   class TokenExpired < StandardError
     def message

data/lib/cognito_token_verifier/token.rb

@@ -5,10 +5,13 @@ module CognitoTokenVerifier
     attr_reader :header, :decoded_token
 
     def initialize(jwt)
-      @header= JSON.parse(Base64.decode64(jwt.split('.')[0]))
-      @jwk = JSON::JWK.new(CognitoTokenVerifier.config.jwks["keys"].detect{|jwk| jwk['kid'] == header['kid']})
-      @decoded_token = JSON::JWT.decode(jwt, @jwk)
-      # TODO: rescue errors for JSON/JWK/JWT parsing/decoding to present user-friendly "token could not be decoded" error
+      begin
+        @header= JSON.parse(Base64.decode64(jwt.split('.')[0]))
+        @jwk = JSON::JWK.new(CognitoTokenVerifier.config.jwks["keys"].detect{|jwk| jwk['kid'] == header['kid']})
+        @decoded_token = JSON::JWT.decode(jwt, @jwk)
+      rescue JSON::JWS::VerificationFailed, JSON::JSONError => e
+        raise TokenDecodingError
+      end
     end
 
     def expired?

data/lib/cognito_token_verifier/version.rb

@@ -1,3 +1,3 @@
 module CognitoTokenVerifier
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cognito_token_verifier
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Matt Tanous
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-02-20 00:00:00.000000000 Z
+date: 2019-02-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -183,7 +183,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 2.3.8
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="